Location-Oblivious Data Transfer with Flying Entangled Qudits 
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We present a simple and practical quantum protocol involving two mistrustful agencies in 
Minkowski space, which allows Alice to transfer data to Bob at a spacetime location that nei- 
ther can predict in advance. The location depends on both Alice's and Bob's actions. The protocol 
guarantees unconditionally to Alice that Bob learns the data at a randomly determined location; it 
guarantees to Bob that Alice will not learn the transfer location even after the protocol is complete. 

The task implemented, transferring data at a space-time location that remains hidden from the 
transferrer, has no precise analogue in non-relativistic quantum cryptography. It illustrates further 
the scope for novel cryptographic applications of relativistic quantum theory. 



I. INTRODUCTION 

Because quantum states cannot be cloned, and can be 
entangled, someone who generates quantum states can 
retain more information about them than another party 
who receives them. Quantum cryptography exploits this 
information control (and other features of quantum the- 
ory) to implement interesting cryptographic tasks with 
security guaranteed so long as quantum theory is correct. 

The no-signaUing principle of special relativity also al- 
lows the controlled distribution of information, in the 
sense that a party can transfer classical or quantum in- 
formation secure in the knowledge that it can only be 
communicated to the future light cone of the transfer 
point. The important cryptographic task of mistrust- 
ful coin tossing [J] can be implemented using this fact 
alone. More surprisingly, it can also be used to imple- 
ment the (strictly more powerful Q ) task of bit com- 
mitment, via protocols that require only classical infor- 
mation exchanges but which guarantee security against 
Mayers-Lo-Chau quantum attacks 0-0| as well as all clas- 
sical attacks [9, 10]. 

We would like, for both theoretical and practical rea- 
sons, to understand precisely which cryptographic tasks 
can be implemented when we take relativistic quantum 
theory to be the underlying theory, and thus combine 
the information control techniques allowed by both the- 
ories. There have been several interesting recent il- 
lustrations [ni [l3 of the cryptographic power of rel- 
ativistic quantum theory. Work on quantum tagging 
and position-based quantum cryptography has also pro- 
duced new cryptographic schemes for quantum tag ging 
secure against technologically restricted adversaries [IJ- 
[Tg} , some possible limits to the level of security attainable 
for some versions of these tasks [isl [l6| and an uncondi- 
tionally secure protocol [17] for quantum tagging given 
a tagging device that is cryptographically secure - i.e. 
that can keep internal data secret from an adversary. In- 
triguing extensions of quantum tagging to more general 
position-based cryptographic tasks have also been devel- 
oped [15]. 



Light speed constraints are already practically signifi- 
cant in terrestrial technology, even on small scales, and 
will become far more so as we and our technology mi- 
grate further beyond the Earth. So it seems natural not 
only to try to apply these constraints to implement clas- 
sical (non-quantum non-relativistic) tasks, but also to re- 
think what cryptography actually means - what the most 
general interesting and potentially useful cryptographic 
tasks are - in a world governed by relativity and quan- 
tum theory. Although Shor's and Grover's algorithms, 
and other efficient quantum algorithms for intrinsically 
classical computational tasks, were seminal discoveries 
which added great impetus to the development of quan- 
tum computational theory, many believe that intrinsi- 
cally quantum computational tasks may well ultimately 
be the most significant applications of quantum comput- 
ing. It seems by now quite plausible too that intrinsically 
relativistic and quantum cryptographic tasks will also ul- 
timately be among the most significant applications of 
physics-based cryptography and computing. At the very 
least, it seems worth exploring what might be possible 
with this vision in mind. 



In this paper we define a new and intrinsically rela- 
tivistic cryptographic task, data transfer at a spacetime 
location that remains hidden from the transferring party. 
We give a simple and practical protocol for implement- 
ing this task, and show the protocol is unconditionally 
secure, in an appropriately defined sense. The protocol 
is inspired by the no-summoniiig theorem [Tsf and its 
application to bit commitment [12|. Roughly speaking, 
the underlying intuition is that, by producing one qu- 
dit of an entangled pair at an unpredictable point, Alice 
effectively constrains Bob, who has no way of ensuring 
that he can produce the other qudit at or near the same 
point. However, the security proof goes beyond the no- 
summoning theorem, using other features of relativistic 
quantum theory. In particular, it implicitly assumes that 
the unitary evolution of quantum states between any two 
spacelike hypersurfaces can be covariantly defined, as in 
the Tomonaga-Schwinger formalism [Tol . [20| . 
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II. TRANSFERRING DATA WITH 
ENTANGLED FLYING QUDITS 

We give an idealized version of the protocol here to 
simplify the presentation.^ We suppose that space-time 
is Minkowski and that nature is described by some ap- 
propriate relativistic version of quantum theory. We con- 
sider two agencies, Alice and Bob, with representatives 
at all the relevant points in space-time, and suppose that 
both have arbitrarily efficient technology, limited only by 
physical principles, and that all their operations and com- 
munications are error-free. We also suppose they agree in 
advance on some space-time point P, where the protocol 
commences, and on a fixed inertial reference frame. 

We suppose they are also independently able to ac- 
cess suitable points Qi (where i runs from to m — 1) 
in the causal future of P, and that each is able to keep 
information everywhere secure from the other unless and 
until they choose to disclose it. We also suppose that 
Alice and Bob can independently and securely access all 
the points P and Qi and instantaneously exchange in- 
formation there. In particular, Alice can keep a bipar- 
tite entangled state private somewhere in the past of P 
and arrange to transfer one subsystem to Bob at P, and 
Alice's and Bob's subsystems can then be kept private 
unless and until they choose to transfer them at some 
point(s) in the future of P. We also suppose that both 
parties can send any relevant states at light speed in pre- 
scribed directions along secure quantum channels. 

Apart from our idealized assumptions about indepen- 
dent access to suitable space-time points, we are following 
here the standard conventions of mistrustful cryptogra- 
phy. Alice and Bob mistrust one another, and each trusts 
only operations they carry out themselves in their own 
secure "laboratories" . As is standard in mistrustful cryp- 
tography, the aim of our protocol is to offer each some 
guaranteed control over the information obtained by the 
other, despite their mistrust. We need not consider the 
actions of any third parties (for instance an interfering 
eavesdropper Eve), since as far as Alice is concerned ev- 
erything outside her laboratory is potentially under Bob's 
control, and vice versa. 

We focus here on a specific version of the protocol, 
with TO = 2: the protocol can obviously be extended to 
larger m, to various geometries, and to variants involv- 
ing multipartite entanglement. For m = 2, Alice and 
Bob agree two distinct spatial directions vq and vi in the 
agreed frame. For simplicity, we focus here on one natu- 
ral choice, in which the Vi are opposite; we set c = 1, take 
P to be the origin and the two spatial directions to be de- 



fined by the vectors Vq = (—1, 0, 0, 0) and vi = (1, 0, 0, 0) 
in the fixed frame coordinates (x, y, z, t). 

Before the protocol, Alice generates a two qudit state; 
the dimension d is a pre-agreed parameter. This state de- 
termines the datum that will be transferred in the pro- 
tocol. If the protocol is followed. Bob will receive an 
integer in the range 1, . . . , d^. Suppose for the moment 
that Alice wishes this integer to be classically determined 
from the start of the protocol. She then prepares a max- 
imally entangled state V'i 6 (8> C^, chosen from a pre- 
agreed orthonormal basis labelled by i = 1, . . . , d^. This 
is encoded in two physical subsystems which (idealizing 
again) we take to be pointlike. She keeps the state pri- 
vate until P, where she gives the second subsystem to 
Bob. Alice now uses a private equiprobable random bit 
j e {0, 1} and sends the first subsystem along a secure 
channel that she controls at light speed in the direction 
Vj, i.e. along the line Lq = {{—ii 0, 0, i), t> 0} (for j = 0) 
or the line Li = {{t, 0, 0, t), i > 0} (for j = 1).^ 

Bob is free to act as he wishes, depending on his pre- 
ferred distribution for the point of data transfer. If he 
wishes to maximize his chance of obtaining the data at 
the earliest'^ possible point in space-time, then he also 
randomly chooses a bit k G {0, 1} by flipping a fair coin 
and sends the second subsystem along a secure channel 
that he controls at light speed in the direction v^. 

To transfer the datum to Bob, Alice gives him the sec- 
ond subsystem at some point Qj along the line Lj . The 
points Qo and Qi (but not Alice's choice j) could be 
agreed in advance, in which case Bob knows to expect 
the data at one of two possible points. However, if Alice 
wishes to retain freedom in choosing the transfer point, 
she can choose any point Qj along Lj , provided that Bob 
is prepared to receive data there. To simplify here, we as- 
sume Qo = {-T, 0, 0, T] and Qi = {T, 0, 0,V} are fixed, 
for some agreed choice of T. 

The transferred datum is the value oi i. To obtain this 
information. Bob needs to carry out a measurement of 
the two subsystems in the agreed orthonormal basis. His 
measurement need not necessarily be local; however, if 
not, then Bob will possess the datum i only at points 
where he is able to combine all the data obtained from 
non-local measurement operations. 



A. Security against Alice 

Alice has little scope for cheating. She can choose the 
joint state of the two subsystems to be a state other than 
one of the basis states tpi. If she does. Bob will ultimately 



^ As in other applications inspired by the no-summoning the- 
orem [iSl . these unphysical idealizations can be relaxed without 
affecting the essential idea, and it is easy to adjust the protocol 
so that it can be securely implemented under realistic physical 
assumptions, allowing for noise and time lags. See Refs. [Tsl 
for illustrations. 



^ By requiring light speed transmission in opposite directions we 
ensure the possible data transfer points separate as fast as possi- 
ble in the given frame. Neither constraint is necessary, however: 
the protocol achieves location-oblivious data transfer so long as 
Qo and Qi are spacelike separated. 

^ With respect to the Minkowski causal partial ordering. 



3 



obtain an i corresponding to the random outcome of his 
measurement. Nonetheless, Bob obtains a value of i. The 
aim of this protocol is simply to ensure that Alice trans- 
fers some datum to Bob: as with classical oblivious trans- 
fer , there is no requirement that the datum transferred 
should be "correct" by any external standard. Nor do we 
require that the datum be classically determined before 
the protocol is complete - something which is not possible 
with any intrinsically quantum protocol (see e.g. [HI)- 
Alice's freedom in choosing the joint state thus does not 
constitute cheating. 

Alice's only other freedom is to choose j by some pro- 
cedure other than flipping a fair coin. This gives her no 
advantage, assuming ~ as we will here - that Alice and 
Bob each assign equal utility to Bob knowing the datum 
at points {x,y,z,t) and {—x,y,z,t), for any coordinate 
values.'' 

Moreover, given this symmetry of utilities, it can only 
help Bob if Alice deviates from unbiased randomness: 
if he learns some information about Alice's strategy for 
choosing j he may alter his own strategy in response, and 
thus increase the chance that the datum is transferred to 
him earlier. We need not consider this possibility, since 
it involves both parties violating the protocol^, but in 
any case there is no motivation for Alice to pursue this 
strategy. 



B. Security against Bob 

Bob may act as he wishes, constrained only by the 
laws of quantum theory and relativity. By definition, 
he cannot cheat. Interestingly, though, he is nonetheless 
quite constrained. We say Bob learns^ the correct value 
of i if he obtains it by some strategy which (in the ideal 
error-free case) guarantees that, if it produces an answer 
i' and Alice chose a classically pre-determined i, then 

Suppose first that he follows the strategy above, send- 
ing his qudit in a randomly chosen direction Vk (k = 
or 1), and suppose without loss of generality that fc = 0. 
He then learns the value of j at Qq, where he either re- 
ceives the second qudit {j = 0) or does not {j = 1); he 
similarly learns this value at Qi. If j = 0, he can obtain 
the datum i at Qq, by carrying out a local measurement 
on both qudits there. If j = 1, he now has the two qu- 
dits at spacehke separated locations, Qo and Qi, and is 
aware of the situation at both locations. For any point 
X, we write L{X) for the set containing X and its future 



If their utilities are asymmetric, things become more compli- 
cated, and we need game theory to determine Alice's and Bob's 
optimal actions. 

^ As usual in mistrustful cryptography, the aim is to protect an 
honest party against a cheat; we do not aim to protect cheats 
against the consequences of their own misbehaviour. 

® I.e. comes to know with certainty. 



light cone. Bob can obtain the datum i at any point Y in 
the intersection L{QQ)riL{Qi) by sending the two qudits 
from Qo and Qi to Y7 And this is the best Bob can do 
when he holds the two entangled qudits at Qo and Qi: 
he cannot then learn the datum i at any location outside 
L(Qo)nL(Qi). 

In summary, following this strategy, with probability i 
he learns i at Qj , and with probability i he learns i only 
at Y. Note that Alice never learns k, and so does not 
know the location at which Bob learns i, since all Bob's 
operations are private. 

In fact, the above strategy is optimal for Bob, in the 
following sense: (i) Bob has no strategy that gives him 
probability greater than of learning i at any point out- 
side L{Qj), and (ii) Bob has no strategy that gives him 
probability greater than i of learning i at any point out- 
side i(Qo) nL(Qi). 

To see (i), we simply observe that Bob has no access 
to the subsystem defined by until Alice transfers it at 
Qr 

To see (ii), consider a spacelike hypersurface S close 
to and in the past of the boundary of L{Qo) U L{Qi). 
For simplicity, take S to be symmetric under reflec- 
tions in the x-coordinate, and define the subsurfaces 
So — {{x,y,z,t) G S : X < 0} and 5*1 = {{x,y,z,t) G 
S : x>0}. 

Without loss of generality, we can consider Bob's ac- 
tions between P and S as defined by a unitary operation 
acting on Cg together perhaps with ancillary states, gen- 
erating some quantum state on S. Hence at least one of 
the states defined by the restriction of this state to 5*0 or 
must be entangled with the state held by Alice. 
As Bob does not know j until after the points Qo and 
Qi, his actions up to S are independent of the choice of 
j. Hence, with probability > i. Bob generates a state on 
Sj - the opposite half of the hypersurface to Qj - that is 
entangled with the state transferred by Alice at Qj . Bob 
thus cannot learn the outcome of the desired measure- 
ment at any point not in the intersection of the future 
light cone of Qj and the future light cone of at least one 
point in Sj . As we can find spacelike S arbitrarily close 
to the boundary of L{Qo) U L{Qi), the result follows. 



III. DISCUSSION 

The task defined here, transferring data at a location 
that remains hidden from the transferrer, has no precise 
analogue in classical or non-relativistic quantum cryptog- 
raphy, although it bears some resemblance to classical 
oblivious transfer Q. Like classical oblivious transfer. 



He could also achieve this by a variety of other strategies, for 
example by using a second predistributed entangled pair of qudits 
to carry out a nonlocal measurement at Qo and Qi and sending 
the results to Y. 
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it is probably not very useful in itself, but could be a 
building block for much more useful tasks (as oblivious 
transfer is p2j). 

In any case, it illustrates some interesting possibilities 
in relativity-based cryptography. First, one can aim to 
control where exactly in spacetime various parties learn 
information as a result of a protocol. In our protocol 
this control is randomized; it would also be interesting 
to explore the (im)possibility of deterministic location 
control. Second, the locations at which information is 
learned themselves constitute information generated by 
the protocol, and the flow of this information is also con- 
trolled. Moreover, this control can be asymmetric ~ in 
our protocol. Bob learns the location information, and 
Alice never does. 

These possibilities raise some intriguing questions. For 
example, one can imagine secure multi-party computa- 
tion |23| scenarios in which parties are supposed to learn 
some outputs given by prescribed joint functions of the 
inputs, but it does not matter that various parties even- 
tually learn partial or even complete data about other 
parties' input data, as long as there are strong enough 
constraints on where in spacetime they learn this. It 
would be very interesting to understand whether, and 
under what conditions, such constraints can be imple- 
mented securely. 

Our protocol imposes strong constraints on Bob what- 
ever it does. However, it should be stressed that he has 
more general possibilities than those highlighted above, if 
he is willing to accept some risk that he will never obtain 
the correct value of Alice's input datum. For example, he 



could carry out some form of partial cloning on his qudit 
and send the two outputs to Qo and Qi respectively, and 
then obtain some information about z by a local mea- 
surement at Qj, whichever j Alice chooses. It would be 
interesting to characterize the tradeoffs available to Bob 
via his most general strategies. 

Finally, one might perhaps wonder whether the proto- 
col is intrinsically quantum, or whether it could perhaps 
be implemented classically. For example, could Alice ini- 
tially give Bob a classical bit 60 at P, and a second bit 
bi at one of the Qi, in order to transfer the bit sum 
b — bo (B bi? A little thought shows this does not re- 
strict Bob, since once he receives bo he can simply broad- 
cast it in all directions, ensuring that he obtains b at 
whichever point Alice chooses to return 61. More gener- 
ally, since the security proof relies on the no-summoning 
theorem, which holds in relativistic quantum theory but 
not in relativistic classical theories, no classical protocol 
can achieve the same result. 
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